The npm package 'base-ui-cli' version 1.1.47 is identified as malicious. It issues fetch() requests to a suspicious Cloudflare Workers host controlled by an individual rather than an official registry, potentially allowing attacker-controlled substitution of package content or interception of credential-bearing requests. The package name mimics a legitimate Base UI component library, suggesting it is an imposter designed to deceive users.